# no f***ing way

Source: https://www.youtube.com/watch?v=sZ8aAkeZ6dw
Recap page: https://rapidrecap.app/video/sZ8aAkeZ6dw
Generated: 2026-02-12T16:05:47.81+00:00

---
## Quick Overview

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-20841, existed in Windows 11 Notepad because the application improperly sanitized special elements in Markdown links, allowing attackers to execute local or remote programs silently by tricking users into clicking a specially crafted link, which Microsoft has since fixed in the February 2026 Patch Tuesday updates.

**Key Points:**
- Microsoft fixed a high-severity Remote Code Execution (RCE) vulnerability in Windows 11 Notepad, tracked as CVE-2026-20841.
- The flaw was caused by improper neutralization of special elements used in a command injection within Markdown links displayed by Notepad.
- Attackers could trick users into clicking a malicious Markdown link that pointed to local executable files or special URIs (like ms-appinstaller:), causing code execution without security warnings.
- The exploit was demonstrated using a `file:///` URI pointing to a remote SMB share containing a batch file, which executed upon clicking the link.
- The vulnerability stems from Notepad gaining network-aware rendering capabilities (like Markdown support) without properly sanitizing URI handling, contrasting with its long history as a simple text utility.
- The fix requires users to click the link, which now displays a 'This link may be unsafe' warning, preventing silent execution.
- The video sponsor, ThreatLocker, demonstrates how their Zero Trust endpoint protection platform detects and blocks the execution of the malicious script, even when the Windows built-in warning is bypassed.

![Screenshot at 00:39: Microsoft has fixed a remote code execution vulnerability in Windows 11 Notepad that allowed attackers to execute local or remote programs by tricking users into clicking specially crafted Markdown links, without displaying any Windows security warnings.](https://ss.rapidrecap.app/screens/sZ8aAkeZ6dw/00-00-39.jpg)

**Context:** The video discusses a significant security flaw discovered in the updated version of Windows 11 Notepad, which gained Markdown support, allowing it to process links. This feature introduced a critical vulnerability where specially crafted Markdown links could be used to execute arbitrary code or files on a victim's system without triggering standard Windows security prompts, leading to a Remote Code Execution (RCE) scenario.

## Detailed Analysis

Microsoft patched a critical RCE vulnerability in Windows 11 Notepad, tracked as CVE-2026-20841, which was disclosed as part of the February 2026 Patch Tuesday updates. The flaw existed because Notepad, now modernized to support Markdown, failed to properly neutralize special elements within Markdown links. This allowed an attacker to craft a link that, when clicked by a user, would silently execute local or remote programs, bypassing security warnings. The exploit demonstrated involved using a `file:///` URI pointing to a batch file on a remote SMB share. When the user clicked the rendered link in Notepad, the system executed the script without prompting the user or showing the usual security warning associated with running unsigned executables. The video contrasts this behavior with the behavior seen after the fix, where clicking a similar link now correctly triggers a security warning dialog box stating, 'This link may be unsafe. Do you want to continue?' The presenter argues that this vulnerability is a result of 'feature bloat'—adding complex network-aware features like Markdown rendering to a historically simple utility—rather than being related to AI mandates. The segment concludes with a demonstration of how ThreatLocker, a Zero Trust endpoint protection platform, successfully detects and blocks the execution of the malicious script even before the Windows warning appears, enforcing policies like denying network access to the Notepad process.

### Vulnerability Details

- Microsoft fixed a remote code execution vulnerability (CVE-2026-20841) in Windows 11 Notepad
- The flaw involved improper neutralization of special elements in Markdown links, enabling silent execution of local/remote programs via user clicks
- The exploit used `file:///` URIs pointing to executables on remote shares (e.g., SMB).

### Exploit Demonstration

- The attacker creates a Markdown file containing a link pointing to a remote batch file (`file:///10.0.0.253/windows-share/test.bat`)
- Before the fix, clicking this link executed the file silently
- After the patch, clicking the link prompts a 'This link may be unsafe' warning.

### Security Implication

- The vulnerability is attributed to feature bloat—adding complex network-aware rendering to Notepad—rather than a memory corruption issue
- The core issue is the lack of network access restriction for the Notepad process when rendering links.

### ThreatLocker Mitigation

- The sponsor, ThreatLocker, demonstrates blocking the execution of the PowerShell script using its Zero Trust endpoint protection platform
- ThreatLocker detected the attempt and blocked execution by denying network access to the Notepad process, even if the user clicked 'Run' on the Windows warning.

![Screenshot at 00:09: The video presenter introduces the topic by showing the BleepingComputer article headline about the Windows 11 Notepad flaw allowing silent file execution via Markdown links.](https://ss.rapidrecap.app/screens/sZ8aAkeZ6dw/00-00-09.jpg)
![Screenshot at 00:39: The article text confirming Microsoft fixed a remote code execution vulnerability in Windows 11 Notepad related to clicking specially crafted Markdown links.](https://ss.rapidrecap.app/screens/sZ8aAkeZ6dw/00-00-39.jpg)
![Screenshot at 02:06: A proof-of-concept \(PoC\) Markdown code snippet showing commands to install a file via ms-appinstaller: and run an executable via file:///C:/windows/system32/cmd.exe.](https://ss.rapidrecap.app/screens/sZ8aAkeZ6dw/00-02-06.jpg)
![Screenshot at 02:51: The Windows Security Warning dialog box that appears after clicking the link in the patched version, indicating the file is from an untrusted location.](https://ss.rapidrecap.app/screens/sZ8aAkeZ6dw/00-02-51.jpg)
![Screenshot at 04:55: The sponsor message for ThreatLocker, a Zero Trust endpoint protection platform designed to stop attackers from gaining a foothold in the network.](https://ss.rapidrecap.app/screens/sZ8aAkeZ6dw/00-04-55.jpg)